Threats tagged 'ghsa-p836-85q4-qgxj'

A stored Cross-Site Scripting (XSS) vulnerability exists in Alosuite's delivery note functionality due to insufficient sanitization and encoding of input fields. Authenticated users can inject JavaScript code that executes in other users' browsers when viewing affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability specifically affects the 'Codigo' parameter in the '/CategoriasFicheros/Edit/{id}' endpoint.